macOS a11y: Fix hit testing frame checks to support Hover Text in Views

This changelist modifies accessibilityHitTest in AXPlatformNodeCocoa so
that it only recurses on child accessibility elements with frames that
contain the specified point for hit testing. Per the Apple Developer
Documentation for accessibilityHitTest, the method should only be called
when the specified point has already been determined to lie within the
accessibility element's frame.

Previously, the lack of child bounds checking sometimes resulted in web
content being unexpectedly returned by the hit test, even if the point
was actually over the browser chrome, e.g. a toolbar button.

AX-Relnotes: macOS accessibility feature Hover Text now works in the tab
             strip, toolbar, and bookmark bar.

Bug: 1090845
Change-Id: I649d902f8214387fe6e0930b637f2b0e85cc0649
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2227865Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Commit-Queue: Brian Liu Xu <brx@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#774747}

ui/accessibility/platform/ax_platform_node_mac.mm

@@ -497,6 +497,8 @@ bool AlsoUseShowMenuActionForDefaultAction(const ui::AXNodeData& data) {
     return nil;
 
   for (id child in [[self AXChildren] reverseObjectEnumerator]) {
+    if (!NSPointInRect(point, [child accessibilityFrame]))
+      continue;
     if (id foundChild = [child accessibilityHitTest:point])
       return foundChild;
   }